Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

quantumlab

Run the /home/bram/work/quantum_lab Python scripts and demos inside the existing venv ~/.venvs/qiskit. Use when asked (e.g., via Telegram/OpenClaw) to run quant_math_lab.py, qcqi_pure_math_playground.py, quantum_app.py subcommands, quantumapp.server, or notebooks under the repo.

MIT-0 · Free to use, modify, and redistribute. No attribution required.
0 · 1.5k · 0 current installs · 0 all-time installs
byBram Dobbelaar@BramDo
duplicate of @BramDo/quantum-lab
MIT-0
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The declared purpose (run the quantum_lab repo inside a qiskit venv) matches the files and instructions. The SKILL.md and qexec.sh consistently target a repo root and a venv and provide wrappers for running the listed scripts. Minor oddity: the description references an explicit path (/home/bram/...), but the script uses $HOME and allows overrides via QUANTUM_LAB_ROOT and VENV_PATH.
!
Instruction Scope
The instructions tell the agent to shell out into the repository via scripts/qexec.sh which sources the venv and execs any arguments. While the documented commands are limited (specific python scripts, notebooks, server), nothing in the wrapper prevents the agent from running arbitrary commands (e.g., pip install, arbitrary Python scripts, shell commands) inside your home, reading repo files, or launching network services (python -m quantumapp.server). That broad execution capability is expected for this use-case but increases risk if the agent or the repository are untrusted.
Install Mechanism
Instruction-only skill with a small helper script; no install steps or external downloads. There is nothing being pulled from external URLs or installed automatically by the skill itself.
Credentials
The skill requests no credentials or config paths in the registry metadata. It does rely on access to a venv and a repo in your HOME and allows overrides via QUANTUM_LAB_ROOT and VENV_PATH. That is proportionate to its purpose, but it implicitly requires filesystem access to the specified paths and the ability to source the venv and run commands there.
Persistence & Privilege
always:false and the skill is user-invocable; it does not request permanent presence or attempt to modify other skills. However, because the platform allows autonomous invocation by default, combining autonomous invocation with the ability to run arbitrary commands increases potential impact — you may want to restrict autonomous use if you don't fully trust the repo or agent behavior.
What to consider before installing
This skill legitimately runs a local quantum_lab repo inside a qiskit virtualenv, but it grants the agent the ability to execute arbitrary commands in your repo and venv and to start network services. Before installing: 1) Inspect and trust the contents of ~/work/quantum_lab (or set QUANTUM_LAB_ROOT to a sandbox/copy). 2) Consider using a disposable/sandboxed venv or container rather than your personal ~/.venvs/qiskit. 3) If you do not fully trust autonomous agent actions, disable autonomous invocation or require manual confirmation before running the skill. 4) Be cautious about commands that install packages (pip install -r requirements.txt) or launch servers (python -m quantumapp.server) — these can modify your environment or expose services. If you want to proceed, set explicit QUANTUM_LAB_ROOT and VENV_PATH to controlled paths and review the repo code first.

Like a lobster shell, security has layers — review code before you run it.

Current versionv1.0.0
Download zip
latestvk97amjedb95ab4yw75rpygszw980jdpd

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

SKILL.md

Quantum Lab

Overview

Run quantum_lab repo commands inside the preexisting qiskit venv. Prefer the helper scripts in scripts/ so the venv and repo root are always set.

Command List (full)

Use <SKILL_DIR> as the folder where this skill is installed (e.g., ~/clawd/skills/quantum-lab).

  • bash <SKILL_DIR>/scripts/qexec.sh python quant_math_lab.py
  • bash <SKILL_DIR>/scripts/qexec.sh python qcqi_pure_math_playground.py
  • bash <SKILL_DIR>/scripts/qexec.sh python quantum_app.py
  • bash <SKILL_DIR>/scripts/qexec.sh python quantum_app.py self-tests
  • bash <SKILL_DIR>/scripts/qexec.sh python quantum_app.py playground
  • bash <SKILL_DIR>/scripts/qexec.sh python quantum_app.py notebook notebooks/SomeNotebook.ipynb
  • bash <SKILL_DIR>/scripts/qexec.sh python -m quantumapp.server --host 127.0.0.1 --port 8000

Command List (short)

Use these for quick Telegram/OpenClaw commands. Both gl and ql are supported and equivalent.

  • bash <SKILL_DIR>/scripts/gl self-tests
  • bash <SKILL_DIR>/scripts/gl playground
  • bash <SKILL_DIR>/scripts/gl app
  • bash <SKILL_DIR>/scripts/gl lab-tests
  • bash <SKILL_DIR>/scripts/gl playground-direct
  • bash <SKILL_DIR>/scripts/gl notebook notebooks/SomeNotebook.ipynb
  • bash <SKILL_DIR>/scripts/gl web 8000

Shorthand Handling

If the user types gl ... or ql ... without a full path, always expand it to the full command:

  • gl <args>bash <SKILL_DIR>/scripts/gl <args>
  • ql <args>bash <SKILL_DIR>/scripts/ql <args>

Notes

  • Repo root default: $HOME/work/quantum_lab (override with QUANTUM_LAB_ROOT).
  • Venv default: ~/.venvs/qiskit (override with VENV_PATH).
  • If dependencies are missing: bash <SKILL_DIR>/scripts/qexec.sh pip install -r requirements.txt.

Files

3 total
Select a file
Select a file to preview.

Comments

Loading comments…